AOL Instant Messenger Filename Handling Format String

Medium Nessus Network Monitor Plugin ID 1254

Synopsis

The remote host is vulnerable to format string flaw

Description

The remote host is running AOL Instant Messenger (AIM). Version 4.1.2010 of AIM is vulnerable to a format string attack that may exploited by an attacker to crash a victim's IM client, leading to a denial of service. The vulnerability lies in AIM's improper handling of file transfers of filenames containing "%s".

Solution

Upgrade to the latest version of AOL Instant Messenger.

Plugin Details

Severity: Medium

ID: 1254

Published: 2004/08/20

Modified: 2018/09/16

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 4.3

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

CVSSv3

Base Score: 3.6

Temporal Score: 3.3

Vector: CVSS3#AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Temporal Vector: CVSS3#E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:aol:aim

Reference Information

CVE: CVE-2000-1000

BID: 1747